IN THE CLAIMS 

Please amend claims 1, 14, 27, 29 and 30 as set forth below, and cancel claims 12, 25, 
and 28 without prejudice or disclaimer. All pending claims and their present status are 
produced below. 

1 . (Currently Amended) A method for calculating application verb response times, 
comprising: 

receiving packet data; 

aggregating the packet data into flows; 

identifying application verbs and information relating to them associated with the 
flows; 

determining whether the application verbs are valid; 

responsive to determining that the application verbs are valid, updating a state 
machine if it is determin e d that th e application verbs are valid ;-and 

determining whether the state machine is in a valid state; and 

responsive to determining that the state machine is in a valid state, storing the 

information relating to the application verbsftJL wherein the information 
relating to the application verbs is capable of being used to calculate response 
times associated therewith. 

2. (Original) The method as recited in claim 1, and further comprising determining 
whether the packet data is associated with a new flow. 1 
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3. (Original) The method as recited in claim 2, wherein if the packet data is determined 
to be associated with a new flow, further comprising creating a flow, creating a data 
structure, and inserting the data structure into the flow. 

4. (Original) The method as recited in claim 3, wherein the creation of the data structure 
includes identifying a protocol identifier associated with the flow, and determining a 
number of known application verbs associated with the protocol identifier. 

5. (Original) The method as recited in claim 4, wherein the creation of the data structure 
further includes allocating memory for the data structure based on the number of 
known application verbs associated with the protocol identifier. 

6. (Original) The method as recited in claim 4, wherein the number of application verbs 
associated with the protocol identifier is determined utilizing a map. 

7. (Original) The method as recited in claim 6, wherein the map maps to a RMON tree. 

8. (Original) The method as recited in claim- 1, and further comprising inserting a data 
structure into the flows. 

9. (Original) The method as recited in claim 8, wherein the aggregation includes 
populating and updating the data structure with the information. 

10. (Canceled) 
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11. 



(Original) The method as recited in claim 9, wherein the aggregation further includes 
determining whether a response is complete, and calculating a response time if it is 
determined that the response is complete. 



12. (Canceled) 

13. (Original) The method as recited in claim 1 , wherein the information relating to the 
application verbs is capable of being used to calculate response times associated 
therewith in real-time. 

14. (Currently Amended) A computer-readable medium having a computer program 
product for calculating application verb response times, comprising: 
computer code for receiving packet data; 

computer code for aggregating the packet data into flows; 

computer code for identifying information relating to application verbs associated 
with the flows; 

computer code for determining whether the application verbs are valid; 
computer code for, responsive to determining that the application verbs are valid, 
updating a state machine if it is d e t e rmined that th e application v e rbs ar e 

computer code for determining whether the state machine is in a valid state; and 
computer code fo r, responsive to determining that the state machine is in a valid state, 
storing the information relating to the application verbs[[;]] a wherein the 
information relating to the application verbs is capable of being used to 
calculate response times associated therewith. 
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15. (Previously Presented) The computer-readable medium of claim 14, wherein the 
computer program product further comprises computer code for determining whether 
the packet data is associated with a new flow. 

16. (Previously Presented) The computer-readable medium of claim 15, wherein if the 
packet data is determined to be associated with a new flow, further comprising 
computer code for creating a flow, creating a data structure, and inserting the data 
structure into the flow. 

17. (Previously Presented) The computer-readable medium of claim 16, wherein the 
creation of the data structure includes identifying a protocol identifier associated with 
the flow, and determining a number of application verbs associated with the protocol 
identifier. 

18. (Previously Presented) The computer-readable medium of claim 17, wherein the 
creation of the data structure further includes allocating memory for the data structure 
based on the number of known application verbs associated with the protocol identifier. 

19. (Previously Presented) The computer-readable medium of claim 17, wherein the 
number of known application verbs associated with the protocol identifier is 
determined utilizing a map. 

20. (Previously Presented) The computer-readable medium of claim 19, wherein the map 
maps to a RMON tree. 
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21. (Previously Presented) The computer-readable medium of claim 14, wherein the 
computer program product further comprises computer code for inserting a data 
structure into the flows. 

22. (Previously Presented) The computer-readable medium of claim 21, wherein the 
aggregation includes populating and updating the data structure with the information. 

23. (Canceled) 

24. (Previously Presented) The computer-readable medium of claim 22, wherein the 
aggregation further includes determining whether a response is complete, and 
calculating a response time if it is determined that the response is complete. 

25. (Canceled) 

26. (Previously Presented) The computer-readable medium of claim 14, wherein the 
information relating to the application verbs is capable of being used to calculate 
response times associated therewith in real-time. 

27. (Currently Amended) A system for calculating application verb response times, 
comprising: 

means for receiving packet data; 

means for aggregating the packet data into flows; 

means for identifying information relating to application verbs associated with the 
flows; 

means for determining whether the application verbs are valid; 
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means fo r, responsive to determining that the application verbs are valid, updating a 
state machine if it is d e t e rmin e d that th e application v e rba ar e valid ;-and 
means for determining whether the state machine is in a valid state; and 
means fo r, responsive to determining that the state machine is in a valid state, storing 
the information relating to the application verbs[[;]] A wherein the information 
relating to the application verbs is capable of being used to calculate response 
times associated therewith. 

28. (Canceled) 

29. (Currently Amended) A method for calculating response times, comprising: 
receiving packet data; 

aggregating the packet data into a flow; 

identifying information relating to application verbs associated with the flow; 
determining whether the application verbs are valid; 

responsive to determining that the application verbs are valid, updating a state 
machine if it is d e t e rmin e d that the application v e rbs ar e valid ; 

determining whether the state machine is in a valid state; 

responsive to determining that the state machine is in a valid state, storing the 

information relating to the application verbs in a data structure; 

inserting the data structure in the flow; and 

mapping the data structure to a remote monitoring (RMON) tree. 

30. (Currently Amended) A method for calculating response times, comprising: 
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(a) receiving packet data; 

(b) determining whether the packet data is associated with a new flow; 

(c) if the packet data is determined to be associated with a new flow: 

(i) creating a flow, 

(ii) providing a notification of the flow, 

(iii) creating a data structure in response to the notification, the creation of the data 
structure including: 

1) identifying a protocol identifier associated with the flow, 

2) caching the protocol identifier, 

3) determining a number of known application verbs associated with the 
protocol identifier, and 

4) allocating memory for the data structure based on the number of 
known application verbs associated with the protocol identifier, and 

(iv) inserting the data structure into the flow; and 

(d) aggregating the packet data by: 

(v) identifying application verbs in the flow, 

(vi) determining whether the application verbs are valid, 

(vii) responsive to determining that the applications verbs are valid, updating a 
state machine if it is d e termined that tho application verbs are valid , 

(viii) determining whether a response associated with the flow is complete, 

(ix) responsive to determining that the response associated with the flow is 
complete, calculating a response tim e if it io determined that tho response is 
compl e t e , 

Case 24523-09627 (Amendment B) 

U.S. Application No. 10/039,1 1 1 9 

24523/09627/DOCS/l 563269.3 



(x) determining whether the state machine is in a valid state, and 

(xi) utilizing th e data structure as b e ing repr e s e ntativ e of th e r e spons e tim e if it is 
determin e d that the stat e machin e is in a valid stat e , responsive to determining 
that the state machine is in a valid state, storing information relating to the 
application verbs, wherein the information relating to the application verbs is 
capable of being used to calculate the response time. 
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